CMU5XX-INFOSEC

Information Security for Industry

Session 4: Information Systems Planning & Administration

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Differentiate between Strategic, Tactical, and Operational planning.
  • Integrate security into the Systems Development Life Cycle (SDLC).
  • Justify security budgets using business alignment.
  • Understand the mechanics and necessity of robust Patch Management.
  • Execute a formal Change Control Board (CCB) process.

Seminar Structure (3 Hours)

Part 1: Strategic Alignment (1.5 hrs)
  • Strategic vs Tactical Planning
  • Security in the SDLC
  • Task 1: Security Budget Justification
Part 2: Systems Administration (1.5 hrs)
  • Patch Management Lifecycles
  • Configuration & Change Management (CCB)
  • Task 2: Change Control Simulation

Part 1: Strategic Alignment

Duration: 1.5 Hours

Levels of Planning

Security must align with business goals, or it will be seen as a roadblock.

  • Strategic Planning (3-5 Years): Driven by the Board/CISO. Long-term goals aligning with business vision (e.g., "Migrate all on-premise infrastructure to a Zero Trust Cloud model by 2029 to support remote work").
  • Tactical Planning (1-2 Years): Driven by Directors. Broad initiatives to achieve strategic goals (e.g., "Deploy an Identity Provider (Okta) and enforce MFA across all departments").
  • Operational Planning (Months/Weeks): Driven by Managers. Day-to-day tasks (e.g., "Patch 50 servers this weekend").

Security in the SDLC

The Systems Development Life Cycle (SDLC) is how software is built. "Bolting on" security at the end is expensive and ineffective.

  • Shift-Left: Moving security testing to the earliest phases of development (Requirements & Design).
  • Fixing an architectural flaw during the Design phase costs £100.
  • Fixing that same flaw after the software is deployed to production costs £10,000 and risks a major breach.
  • DevSecOps: Automating security testing within the deployment pipeline.

Budgeting for Security

Security is a cost center. It does not generate revenue; it protects revenue.

  • To secure a budget, a CISO must prove Return on Security Investment (ROSI).
  • You cannot tell a CFO: "We need £50,000 for a Next-Gen Firewall because it stops SQLi."
  • You must tell a CFO: "We process £5M in transactions daily. A breach would cost £2M in GDPR fines and downtime. A £50,000 investment mitigates 80% of this risk."

Introduction to Task 1

The ability to translate technical necessity into business value is the most critical skill for a security manager.

We will simulate pitching a security budget to a non-technical board of directors.

Task 1: Security Budget Justification

Timing: 45 minutes

Your company recently suffered a minor phishing incident. You want to purchase an advanced Email Security Gateway (e.g., Proofpoint) that costs £100,000 annually. The CFO is skeptical, noting you already have standard Microsoft 365 spam filters.

  1. Draft a one-page business case for the CFO.
  2. Calculate the potential cost of a successful ransomware infection stemming from a phishing email (factor in 3 days of total company downtime).
  3. Explain how the £100k investment aligns with the company's Strategic Goal of expanding into the healthcare sector (which requires HIPAA compliance).

15 Minute Break

Please return promptly for Part 2.

Part 2: Systems Administration

Duration: 1.5 Hours

Patch Management

Unpatched software is the root cause of the vast majority of breaches (e.g., Equifax, WannaCry).

  • You cannot just blindly click "Update" on enterprise servers. A bad patch can crash a critical database.
  • The Lifecycle: Discover (Scan) → Assess (Severity) → Test (In a sandbox) → Deploy (In phases) → Verify.
  • Patching Window: IT and Business must agree on a scheduled downtime window (e.g., Sunday 2 AM) for server reboots.

Configuration Management

Maintaining systems in a known, secure state.

  • Baselining: Defining the standard secure configuration for a server (e.g., "All Windows Servers must have RDP disabled and the local Administrator account renamed").
  • Configuration Drift: Over time, admins tweak settings to fix temporary problems and forget to revert them. The server "drifts" away from the secure baseline.
  • Tools like Ansible, Puppet, or Microsoft Endpoint Manager automate baseline enforcement.

Change Control Boards (CCB)

The enemy of availability is an unapproved, untested change made by a "cowboy" admin on a Friday afternoon.

  • All changes to production environments must go through the CCB.
  • The engineer must submit a Change Request (CR) detailing:
    1. The exact technical change.
    2. The testing performed.
    3. The Rollback Plan (How do we revert if it breaks everything?)
  • The CCB (composed of IT, Security, and Business leaders) approves or denies the change.

Introduction to Task 2

A rigorous Change Control process is the hallmark of a mature IT organization. It prevents self-inflicted outages.

We will simulate a Change Control Board meeting reviewing a critical firewall alteration.

Task 2: Change Control Simulation

Timing: 50 minutes

A junior network engineer submits an Emergency Change Request to the CCB: "Need to open Port 3389 (RDP) on the external firewall pointing to the main database server so the vendor can perform urgent maintenance."

  1. As the Security Representative on the CCB, reject this request. Explain the catastrophic risk of exposing RDP to the public internet.
  2. Propose a secure alternative method for the vendor to access the database (e.g., VPN + MFA + Jump Server).
  3. Write the required "Rollback Plan" if the vendor's maintenance accidentally corrupts the database.

Summary & Next Steps

  • Security planning must start at the Strategic level and cascade down into daily Operations via the SDLC and Patch Management.
  • Change Control prevents IT teams from accidentally causing the very downtime they are hired to prevent.
Next Week: Asset Management & Risk Assessment